API overview

Any client - a web frontend, a mobile app, a script - drives a deployed agent over the Sectr HTTP API. See the full reference for complete details.

The primary concept

The journal is the only source of truth. A session is an append-only event log; every “live” view - including the chat stream - is a tail of that journal. This makes reconnecting (Last-Event-ID) trivially correct and produces a fully auditable and debuggable transcript.

The data plane APIs

Area	Endpoints	Auth
Sessions	POST /sessions, GET /sessions/{id}, POST /sessions/{id}/input	invocation key (end users) or platform key (playground)
Streaming	GET /sessions/{id}/events (SSE)	same as the session’s
Approvals	POST /sessions/{id}/approval, GET /approvals	platform key

The control plane APIs

Area	Endpoints	Auth
Apps	GET /apps, GET /apps/{id}, GET /apps/{id}/deployments	platform key
Deployments	POST /deployments, POST /deployments/{id}/activate	platform key
Secrets	PUT /secrets/{key}, GET /secrets, DELETE /secrets/{key}	platform key
API keys	GET/POST /api-keys, DELETE /api-keys/{id}	platform key

API Base URLs

• Prod: https://api.sectr.dev
• Locally, sectr dev serves the same API from its gateway, printed at server startup (usually https://local.sectr.dev:PORT)

Start here

1. Authentication — which key class you need
2. Send a message — create a session, add turns
3. Stream a session — the SSE tail + resumption
4. Approve or deny from your UI
5. Deploy lifecycle